Minimizing sensitive data exposure during preparation of redacted documents

ABSTRACT

A document review and security technique is provided that presents a first portion of a document to a first reviewer, wherein the first portion includes less than the entire document, presents a second portion of the document to a second reviewer, wherein the second portion includes less than the entire document, wherein the second portion is at least partially different from the first portion, and wherein the first reviewer and the second reviewer are different reviewers, receives from the first reviewer a review action input associated with the first portion, receives from the second reviewer a review action input associated with the second portion, and determines a disposition of the document in accordance with the review action inputs.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.13/113,923, filed May 23, 2011, which application is incorporated hereinby reference in its entirety.

BACKGROUND

Embodiments of the invention relate to computer data access control andprivacy in general.

Many organizations maintain documents and data files that includeinformation, such as of a medical or financial nature, that is deemedsensitive and whose exposure to individuals is restricted by companypolicy, or even by law. Such organizations may employ document redactionsoftware that removes sensitive information from documents before theyare shown to individuals requesting access to such documents. Documentredaction software typically removes sensitive information fromdocuments automatically according to a set of predefined rules. However,post-redaction review by a human reviewer is typically required toensure that sensitive data is properly identified as such within adocument and is redacted accordingly. This typically requires that thereviewer be given access to the pre-redacted contents of a document aswell. However, where exposure to sensitive information is restricted toindividuals with specific legal and/or professional qualifications, suchas licensed medical professionals, it is often difficult and expensiveto engage such individuals to perform post-redaction review.

SUMMARY OF THE INVENTION

In one aspect of the invention, a document review and security method,system, and computer-program product are provided that presents a firstportion of a document to a first reviewer, wherein the first portionincludes less than the entire document, presents a second portion of thedocument to a second reviewer, wherein the second portion includes lessthan the entire document, wherein the second portion is at leastpartially different from the first portion, and wherein first reviewerand the second reviewer are different reviewers, receives from the firstreviewer a review action input associated with the first portion,receives from the second reviewer a review action input associated withthe second portion, and determines a disposition of the document inaccordance with the review action inputs.

In another aspect of the invention, a document review and securitymethod, system, and computer-program product are provided that identifya first element within a first document that is contextually related toa second element within the first document in accordance with predefinedcontextual relationship criteria, create a second document including thefirst element, the second element, and a third element, wherein thethird element is not interposed between the first element and the secondelement within the first document, and wherein the third element isinterposed between the first element and the second element within thesecond document, present the second document to a reviewer, receive areview action input from the reviewer, and determine a disposition ofthe first document in accordance with the review action inputs.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The invention will be understood and appreciated more fully from thefollowing detailed description taken in conjunction with the appendeddrawings in which:

FIG. 1 is a simplified conceptual illustration of a document redactionand review system, constructed and operative in accordance withembodiments of the invention;

FIG. 2A is a simplified flowchart illustration of an exemplary techniqueof operation of the system of FIG. 1, operative in accordance withembodiments of the invention;

FIGS. 2B, 2C, and 2D show a document before and after pre-reviewmodification, useful in understanding the method of FIG. 2A, inaccordance with embodiments of the invention;

FIGS. 3-6 are simplified flowchart illustrations of exemplary techniquesof operation of the system of FIG. 1, operative in accordance withalternative embodiments of the invention; and

FIG. 7 is a simplified block diagram illustration of an exemplaryhardware implementation of a computing system, constructed and operativein accordance with embodiments of the invention.

DETAILED DESCRIPTION

The invention is now described within the context of one or moreembodiments, although the description is intended to be illustrative ofthe invention as a whole, and is not to be construed as limiting theinvention to the embodiments shown. It is appreciated that variousmodifications may occur to those skilled in the art that, while notspecifically shown herein, are nevertheless within the true spirit andscope of the invention.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical datastorage device, a magnetic data storage device, or any suitablecombination of the foregoing. In the context of this document, acomputer readable storage medium may be any tangible medium that cancontain, or store a program for use by or in connection with aninstruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

Reference is now made to FIG. 1, which is a simplified conceptualillustration of a document redaction and review system, constructed andoperative in accordance with embodiments of the invention. In the systemof FIG. 1, a document review manager 100 is configured to processcomputer-viewable documents, such as may reside in a document repository102 stored on a computer readable data storage device, and/or processsuch documents after they have been provisionally redacted by a documentprocessing engine 104 that is configured to redact computer-viewabledocuments in accordance with conventional techniques. Document reviewmanager 100 is configured to process such documents by preparingmodified versions of the documents and presenting the modified documentsto one or more reviewers. Document review manager 100 is configured toreceive review action inputs from reviewers of the modified documentsand provide the review action inputs to document processing engine 104.Document processing engine 104 is configured to determine thedisposition of a computer-viewable document, that has not been redactedor that has been provisionally redacted, in accordance with the reviewaction inputs, such as by redacting or further redacting the document,approving a provisionally-redacted document, and/or classifying thedocument (i.e., assigning a classification to the document). Documentprocessing engine 104 may then provide post-review redacted documents toauthorized requestors in accordance with conventional techniques. Any ofthe elements shown in FIG. 1 are preferably executed by, or areotherwise accessible to, a computer 106, such as by implementing any ofthe elements in computer hardware and/or in computer software embodiedin a physically-tangible, computer readable medium in accordance withconventional techniques. Various exemplary techniques of operation ofthe system of FIG. 1 are described hereinbelow.

Reference is now made to FIG. 2A which is a simplified flowchartillustration of an exemplary technique of operation of the system ofFIG. 1, operative in accordance with embodiments of the invention. Inthe method of FIG. 2A, a first portion of a computer-viewable documentis presented to a first reviewer, where the first portion includes lessthan the entire document (block 200). A second portion of the documentis presented to a second reviewer, where the second portion includesless than the entire document, where the second portion differs from thefirst portion, and where the second reviewer is someone other than thefirst reviewer (i.e., where the first reviewer and the second reviewerare different reviewers) (block 202). For example, two modified versionsof the document shown in FIG. 2B may be prepared as the modifieddocument shown in FIG. 2C that includes a portion of the document shownin FIG. 2B and the modified document shown in FIG. 2D that includes adifferent portion of the document shown in FIG. 2B. A review actioninput associated with the first portion is received from the firstreviewer (block 204). A review action input associated with the secondportion is received from the second reviewer (block 206). A reviewaction input may, for example, indicate that a specific portion of thedocument be redacted, or that a provisionally-redacted document appearsto be properly (i.e., correctly) redacted. Additionally oralternatively, a review action input may, for example, indicate that thedocument should be classified as “confidential medical,” and that asecurity constraint be imposed on the document, such as where thedocument may be shown only to medical doctors. A disposition of thedocument is determined in accordance with the review action inputs(block 208) as described hereinabove.

In the method of FIG. 2A, when preparing a modified version of thedocument, a first element within the document may be identified that iscontextually related to a second element within the document inaccordance with predefined contextual relationship criteria, whereuponthe first element, but not the second element, is included within theportion of the document that is included in the modified version. Thus,for example, a credit card number may be identified within the documentas being contextually related to a credit card expiration date withinthe same document, whereupon a modified version of the document ispresented to one reviewer that includes the credit card number but notthe credit card expiration date, while a different modified version ofthe document is presented to a different reviewer that includes thecredit card expiration date but not the credit card number. Similarly, ahospital patient's identification details and the patient's medicaldiagnosis that appear in the same document are preferably shown todifferent reviewers in different modified versions of the document.

The document shown in FIG. 2B exposes the full customer's credit carddetails, including card owner name, number, and expiration time.However, embodiments allow different reviewers review to reviewdifferent document paragraphs, as is illustrated with FIG. 2C and FIG.2D.

Reference is now made to FIG. 3 which is a simplified flowchartillustration of an additional exemplary technique of operation of thesystem of FIG. 1, operative in accordance with embodiments of theinvention. In the method of FIG. 3, a first element is identified withina first computer-viewable document that is contextually related to asecond element within the first document in accordance with predefinedcontextual relationship criteria (block 300), such as a credit cardnumber within a document that is contextually related to the name of acredit card holder within the same document. A second computer-viewabledocument is created including the first element, the second element, anda third element from the first document, where the third element is notinterposed between the first element and the second element within thefirst document, and where the third element is interposed between thefirst element and the second element within the second document (block302). Thus, for example, a second document is created that includes thecredit card number and the credit card holder's name, where one or morewords, sentences, or paragraphs that are found within the first documentin a location other than between the credit card number and the creditcard holder's name, are interposed between the credit card number andthe credit card holder's name. The second document is presented to areviewer (block 304). A review action input associated with the seconddocument is received from the reviewer (block 306). A disposition of thefirst document is determined in accordance with the review action inputs(block 308) as described hereinabove.

Reference is now made to FIG. 4 which is a simplified flowchartillustration of an additional exemplary technique of operation of thesystem of FIG. 1, operative in accordance with embodiments of theinvention. In the method of FIG. 4, a first element is identified withina first computer-viewable document that is contextually related to asecond element within the first document in accordance with predefinedcontextual relationship criteria (block 400). A second computer-viewabledocument is created including the first element, the second element, anda third element from a third computer-viewable document, where the thirdelement is interposed between the first element and the second elementwithin the second document (block 402). The second document is presentedto a reviewer (block 404). A review action input associated with thesecond document is received from the reviewer (block 406). A dispositionof any of the documents is determined in accordance with the reviewaction inputs (block 408) as described hereinabove. The method of FIG. 4differs from the method of FIG. 3 as the method of FIG. 3 involveselements from only one document, whereas in the method of FIG. 4elements of one document are interposed between contextually-relatedelements of another document. For example, if a medical documentrelating to a given patient is to be reviewed to identify sensitiveinformation within the document, information from other medicaldocuments relating to other patients may be interposed betweencontextually-related elements of the reviewed document to make itdifficult to determine which information relates to the given patient,thereby protecting the given patient's privacy.

Reference is now made to FIG. 5 which is a simplified flowchartillustration of an additional exemplary technique of operation of thesystem of FIG. 1, operative in accordance with embodiments of theinvention. In the method of FIG. 5, an image of a document is dividedinto multiple sub-images, where each of the sub-images includes acontiguous area of the document that is less than the entire area of thedocument, and where each of the sub-images is at least partiallydifferent from the other sub-images (block 500). A sub-image may be ofany shape, and the various sub-images may be of different shapes.Preferably, the sub-images collectively cover the entire document, andsub-images of adjacent areas of the document may overlap. A firstsub-image of the document is presented to a first reviewer (block 502).A review action input associated with the first sub-image is receivedfrom the first reviewer (block 504). A second sub-image of the documentis presented to a second reviewer, where the second sub-image differsfrom the first sub-image, and where the second reviewer is someone otherthan the first reviewer (block 506). A review action input associatedwith the second sub-image is received from the second reviewer (block508). A disposition of the document is determined in accordance with thereview action inputs (block 510) as described hereinabove.

In the method of FIG. 5, if a reviewer is unable to provide a reviewaction due to a lack of information relating to a given sub-image beingreviewed by the reviewer, such as where context information for part orall of the contents of the given sub-image can only be determined byviewing part or all of the contents of one or more sub-images that areadjacent to the given sub-image, the reviewer may request permission toview one or more sub-images that are adjacent to the given sub-image.The extent of an adjacent sub-image that is shown to a reviewer whomakes such a request may be predefined by an administrator of the systemof FIG. 1 using any criteria, such as a number of words, sentences,paragraphs, or centimeters deep within the adjacent sub-image from itsborder with the given sub-image previously provided to the reviewer.Requests by reviewers to view adjacent sub-images are preferably loggedfor auditing purposes.

In certain embodiments, the document page-image is divided intogeometric parts, and these parts are presented one at a time to thereviewer. For example, a page can be split into rectangles—horizontally,vertically, diagonally, etc.—or into other geometric shapes whichcompletely cover the page is possible. The way documents are divided maybe defined by an administrator before the process of redaction-reviewbegins. The divided parts may partially overlap.

In certain embodiments, if the presented section of the document is thesingle word and “888” is presented, or if the data is on the edge of ageometric section, it might be difficult to define whether thecontext-less data should be redacted. In such scenarios, the reviewercan see additional context surrounding the data. Optionally, the contextcan be concealed at the review stage, yet revealed on request and loggedfor monitoring. The exposed context for a value “745” could be, on theone hand, “Car 745, produced in” or on the other hand “PersonalIdentification Number 745, valid”, enabling the reviewer to distinguishtext which should be redacted from text which should be exposed.

Reference is now made to FIG. 6 which is a simplified flowchartillustration of an additional exemplary technique of operation of thesystem of FIG. 1, operative in accordance with embodiments of theinvention. In the method of FIG. 6, one or more sensitive elementswithin an computer-viewable document are identified in accordance withsensitivity criteria (block 600). The sensitive elements are presentedto a reviewer while withholding the document from the reviewer (block602). A review action input associated with any of the sensitiveelements is received from the reviewer (block 604). A securityconstraint previously imposed upon the document is removed in accordancewith the review action input (block 606). For example, if a word in adocument was identified as being sensitive, resulting in a securityconstraint being imposed upon the document, such as by redacting theword from the document, the reviewer may indicate in a review actionthat the word should not have been identified as being sensitive,whereupon the security constraint relating to the word is removed.

In will be appreciated that one or more of the above methods may be usedin combination. In addition, computer-viewable documents or portionsthereof that are presented to a reviewer as described hereinabove mayhave some or all of their data “de-identified” before being presented tothe reviewer using conventional techniques, such as where all numericdata are replaced by randomly-generated numbers. Such processing mayalso be referred to as replacing data with deidentifying data. Forexample, before reviewing, all digits in a telephone number are replacedby “8”, so that entities lose their content but keep their context. Forexample, if the reviewer sees that (+888)-888-8888 is presented, thereviewer knows that this is a phone number and verifies whether thephone number has been redacted correctly, while not being exposed to theactual phone number.

Furthermore, such documents or portions may have their data dilutedbefore being presented to the reviewer using conventional techniques,such as where “dummy” data are inserted into a document or portion.

It will be appreciated that the methods described herein may be appliedequally to documents that have not been redacted, as well as todocuments that have been provisionally-redacted, such as by redactionsoftware. It will be further appreciated that the methods describedherein are applicable for any number of modified versions of a documentthat are provided to any number of reviewers, where each versionincludes a partially or completely different portion of the document.

It will be appreciated that the present invention enables reviewers ofdocuments before redaction, as well as provisionally-redacted documents,to see the information they require for redaction review, whileminimizing their exposure to sensitive information that might violateprivacy policies.

Embodiments may split a document into sections, which are presentedindividually to one or more reviewers. The sections can each be a page,a paragraph, a sentence, a word, etc. For example, if the section is aword, a credit card number is shown without showing the neighboringdata, which may be the person's name and credit card expiration date, sothat the credit card number can not be illicitly used. As anotherexample, if the document is split into a paragraph, the patient'spersonally identifying details may be shown separately from herdiagnosis.

Embodiments provide shuffling. In particular, sections may be presentedin a shuffled order to the reviewer or reviewers. Shuffling is within adocument and among different documents. For example, if medicaldocuments are reviewed, and the section is a paragraph, then paragraphscontaining personal details and paragraphs containing medicalinformation are presented from all documents in a shuffled manner. Thus,the reviewer is unable to match between a patient and a medicaldescription.

Embodiments may be used to minimize false positive and false negativeredactions. False positives are cases in which an entity (e.g., a word)is redacted which should not be, and false negatives are cases in whicha entity (e.g., a word) should be redacted and is not. Forfalse-positives, the original content of the redacted entities ispresented to the reviewer to choose which entities have been mistakenlyidentified as sensitive. For false-negatives, the redacted document ispresented to the reviewer, while the redacted entities are hidden. Thismay be the same redacted document which is presented to the end user.The reviewer is able to further scan the document to find sensitiveentities that remain un-redacted and should be added to the set ofredacted entities.

Embodiments allow verification of sensitive data identification byproviding portions of a document to different reviewers. For example,each reviewer may be shown different parts of a redacted document. Suchembodiments reduce the permission level required for the reviewer toreview the document.

With embodiments, a redacted document is transformed in a special waysuch that snippets of sensitive data can be reviewed independently by asingle or by multiple reviewers. Embodiments enable the reviewer todecide upon the correctness of redaction. In the end of the review, thedocument is reassembled from the reviewed portions into one singleredacted document.

Referring now to FIG. 7, block diagram 700 illustrates an exemplaryhardware implementation of a computing system in accordance with whichone or more components/methodologies of the invention (e.g.,components/methodologies described in the context of FIGS. 1-6) may beimplemented, according to embodiments of the invention.

As shown, the techniques for controlling access to at least one resourcemay be implemented in accordance with a processor 710, a memory 712, I/Odevices 714, and a network interface 716, coupled via a computer bus 718or alternate connection arrangement.

It is to be appreciated that the term “processor” as used herein isintended to include any processing device, such as, for example, onethat includes a CPU (central processing unit) and/or other processingcircuitry. It is also to be understood that the term “processor” mayrefer to more than one processing device and that various elementsassociated with a processing device may be shared by other processingdevices.

The term “memory” as used herein is intended to include memoryassociated with a processor or CPU, such as, for example, RAM, ROM, afixed memory device (e.g., hard drive), a removable memory device (e.g.,diskette), flash memory, etc. Such memory may be considered a computerreadable storage medium.

In addition, the phrase “input/output devices” or “I/O devices” as usedherein is intended to include, for example, one or more input devices(e.g., keyboard, mouse, scanner, etc.) for entering data to theprocessing unit, and/or one or more output devices (e.g., speaker,display, printer, etc.) for presenting results associated with theprocessing unit.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

It will be appreciated that any of the elements described hereinabovemay be implemented as a computer program product embodied in a computerreadable medium, such as in the form of computer program instructionsstored on magnetic or optical storage media or embedded within computerhardware, and may be executed by or otherwise accessible to a computer.

While the methods and apparatus herein may or may not have beendescribed with reference to specific computer hardware or software, itis appreciated that the methods and apparatus described herein may bereadily implemented in computer hardware or software using conventionaltechniques.

While the invention has been described with reference to one or morespecific embodiments, the description is intended to be illustrative ofthe invention as a whole and is not to be construed as limiting theinvention to the embodiments shown. It is appreciated that variousmodifications may occur to those skilled in the art that, while notspecifically shown herein, are nevertheless within the true spirit andscope of the invention.

1. A document review and security method, comprising: presenting a firstportion of a document to a first reviewer, wherein the first portionincludes less than the entire document; presenting a second portion ofthe document to a second reviewer, wherein the second portion includesless than the entire document, wherein the second portion is at leastpartially different from the first portion, and wherein the firstreviewer and the second reviewer are different reviewers; receiving,from the first reviewer, a review action input associated with the firstportion; receiving, from the second reviewer, a review action inputassociated with the second portion; and determining a disposition of thedocument in accordance with the review action inputs.
 2. The method ofclaim 1, wherein the first portion has been provisionally redacted, andwherein the review action input associated with the first portionindicates that the first portion has been correctly redacted.
 3. Themethod of claim 1, wherein the determining further comprises: performingat least one of: a) redacting the document, b) assigning aclassification to the document, and c) imposing a security constraintupon the document.
 4. The method of claim 1, further comprising:identifying a first element within the document that is contextuallyrelated to a second element within the document in accordance withpredefined contextual relationship criteria; and including the firstelement within the first portion or the second portion without thesecond element.
 5. The method of claim 1, further comprising: dividingan image of the document into a plurality of sub-images, wherein each ofthe sub-images includes a contiguous area of the document that is lessthan the entire area of the document, wherein each of the sub-images isat least partially different from the other sub-images, and wherein eachof the first portion and the second portion includes at least partiallydifferent subsets of the sub-images.
 6. The method of claim 1, andfurther comprising: receiving a request from the first reviewer to viewa third portion of the document, wherein the third portion is adjacentto the first portion; and providing an extent of the third portion tothe first reviewer.
 7. The method of claim 1, further comprising:performing at least one of: a) replacing any data within the firstportion or the second portion with deidentifying data and b) insertinginto the first portion or the second portion data that are not found inthe document.
 8. A document review and security method comprising:identifying a first element within a first document that is contextuallyrelated to a second element within the first document in accordance withpredefined contextual relationship criteria; creating a second documentincluding the first element, the second element, and a third element,wherein the third element is not interposed between the first elementand the second element within the first document, and wherein the thirdelement is interposed between the first element and the second elementwithin the second document; presenting the second document to areviewer; receiving a review action input from the reviewer; anddetermining a disposition of the first document in accordance with thereview action inputs.
 9. The method of claim 8, wherein the thirdelement is from the first document.
 10. The method of claim 8, whereinthe third element is from a third document.
 11. The method of claim 8,wherein the determining comprises imposing a security constraint uponthe first document.
 12. The method of claim 8, further comprising:performing at least one of: a) replacing any data within the seconddocument with deidentifying data and b) inserting into the seconddocument data that are not found in the first document. 13-25.(canceled)